Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between:

The Customer (hereinafter "Controller"), the natural or legal person who has registered for and uses the Eigentum² platform, and

Ilya Baskakov
(Operating as: Eigentum²)
Von-Müller-Straße 15a
82467 Garmisch-Partenkirchen, Germany
Email: support@dein-eigentum.de

(hereinafter "Processor")

This DPA supplements the Terms of Service and governs the processing of personal data by the Processor on behalf of the Controller in connection with the use of the Eigentum² platform, in accordance with Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

Where the Processor processes personal data for its own purposes, for example the Controller's own account and billing data, the Processor's website and the Processor's own marketing, the Processor acts as controller and that processing is governed by the Privacy Policy rather than by this DPA.

§ 1 Subject Matter and Duration

The Processor processes personal data on behalf of the Controller in connection with the provision of the Eigentum² property management platform as described in the Terms of Service.
The duration of this DPA corresponds to the duration of the underlying service agreement (Terms of Service). This DPA automatically terminates upon termination of the service agreement, subject to the data deletion and return obligations in § 13.

§ 2 Nature and Purpose of Processing

The Processor processes personal data for the following purposes:

Storage and management of tenant and contact data entered by the Controller
Processing of rent payments, security deposits, and financial transaction records
Management of lease contracts and associated documentation
Management of loans and financing, including the AI-assisted reading of loan documents the Controller selects for that purpose (§ 9)
Storage and organisation of property-related documents, images and files
Generating AI-assisted property valuations from property data (§ 9)
Review of valuations submitted by the Controller and their approval or rejection
Facilitating property information sharing with third parties designated by the Controller
Facilitating ownership transfer workflows, including the invitation and participation of third parties designated by the Controller
Generating in-app notifications and reminders derived from the Controller's own records
Sending transactional and service emails on behalf of the Controller (for example notifications, invitations and automated reminders derived from the Controller's own records)
Keeping change histories and records

Subject to § 13(3) and (4), the Processor does not process the personal data it handles on the Controller's behalf for its own purposes, does not sell it, does not use it for advertising, and does not use it to train, fine-tune or improve any machine-learning model.

§ 3 Types of Personal Data

The following types of personal data are processed:

Identification data: First name, last name, salutation, date of birth, nationality
Contact data: Email address, phone number, mobile number, fax number, postal address
Financial data: IBAN, BIC, bank name, payment amounts, rent amounts, security deposit amounts, transaction records
Contractual data: Lease contract details (start and end dates, rent model, notice period, special terms), contract numbers, booking data for short-term lets (stays, number of guests)
Loan and financing data: Lender and borrower details, guarantors, account and reference numbers, principal, balances, interest rates, fixed-rate periods, repayment schedules
Property-related data: Property addresses, coordinates, unit details, area measurements, characteristics, register and legal attributes
Communication data: Notes, correspondence records, share messages
Document data: Uploaded documents, images and files, including their file names, metadata and, necessarily, whatever content the Controller chooses to upload
Emergency contact data: Name, relationship, phone number of designated emergency contacts
Identity verification data: Verification status and timestamps
Professional credentials: Organisation name and professional licence numbers of participants acting in a professional capacity in an ownership transfer

Special categories of personal data (Article 9 GDPR). The platform is not designed for, and does not ask for, special categories of personal data. The Processor neither requires nor evaluates them. They may nevertheless reach the platform through content the Controller uploads or types, for example a death certificate or a probate order in an ownership transfer, a health declaration inside a residual-debt insurance schedule attached to a loan file, or a free-text note. Where that occurs, the Controller remains responsible for having a condition under Article 9(2) GDPR, and the Processor processes such data solely as part of the content it stores on the Controller's behalf. The Controller is advised to redact documents that contain special categories of personal data not required for the purpose.

§ 4 Categories of Data Subjects

The personal data processed concerns the following categories of data subjects:

Tenants: current tenants of properties managed by the Controller
Prospective tenants: individuals considered for tenancy
Guests: guests and enquirers of a short-term or holiday let
Guarantors: persons providing guarantees for tenants
Co-tenants and occupants: additional persons listed on lease contracts
Emergency contacts: persons designated as emergency contacts
Borrowers, co-borrowers and loan guarantors: persons named in loan and financing records and documents
Property managers and service providers: third-party contacts managing or servicing properties
Ownership transfer participants: the persons the Controller invites to a transfer, and the persons named in the documents uploaded to it, which may include buyers, sellers, notaries, agents, spouses, heirs and deceased persons
Recipients of a shared property: the persons to whom the Controller grants access to a property
The Controller's own users: the members of the Controller's organisation, in respect of the data the Controller records about them

§ 5 Controller's Instructions

The Processor shall process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country, unless required to do so by European Union or Member State law to which the Processor is subject. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such notification on important grounds of public interest.
The Controller's instructions are initially defined by this DPA, the Terms of Service, and the functionality of the Eigentum² platform. Each use of a function of the platform constitutes an instruction to carry out the processing that function performs. The Controller may issue additional instructions in Text Form (§ 126b BGB) via email to support@dein-eigentum.de.
The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other European Union or Member State data protection provisions. The Processor may suspend the execution of such an instruction until it is confirmed or withdrawn.

§ 6 Controller's Own Responsibilities

The Controller is responsible for the lawfulness of the processing it instructs, in particular for having a legal basis under Article 6 GDPR and, where applicable, a condition under Article 9(2) GDPR for entering the personal data of third parties into the platform.
The Controller is responsible for informing its own data subjects in accordance with Articles 13 and 14 GDPR, including about the engagement of the Processor and its sub-processors.
The Controller determines what it uploads, whom it invites to an ownership transfer, with whom it shares a property, and which documents it selects for AI-assisted reading. The Processor performs those operations as instructed and does not assess whether they are appropriate.
The Controller is responsible for the administration of its own organisation within the platform: the accounts it creates, the roles and permissions it assigns, and the withdrawal of access from persons who should no longer have it.

§ 7 Processor's Obligations

The Processor processes personal data within the European Economic Area (EEA), except where a sub-processor authorised under § 9 processes data outside the EEA, in which case the safeguards in § 9(7) apply.
The Processor ensures that processing is carried out in accordance with the GDPR, the BDSG, and all other applicable data protection laws.
The Processor takes the measures required under Article 32 GDPR. They are described in the document "Technical and Organisational Measures"; the version published at the conclusion of the contract applies, together with later changes under sentences 3 and 4. The Processor reviews the measures regularly, at least annually, and may replace them with equivalent or better ones; the level of protection agreed at the conclusion of the contract may not be reduced. The Processor notifies the Controller of material changes in text form at least 30 days before they take effect; within that period the Controller may object on reasonable data protection grounds, and § 9(4) applies accordingly. The Controller receives earlier versions on request in text form.
The Processor appoints a Data Protection Officer where required by law; there is currently no such obligation.
The Processor does not use the personal data for any purpose other than performing the services described in this DPA and the Terms of Service.

§ 8 Confidentiality

The Processor shall ensure that all persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they are instructed in data protection before access is granted.
This confidentiality obligation shall survive the termination of this DPA.

§ 9 Sub-Processors

The Controller grants the Processor general written authorisation to engage sub-processors for the processing of personal data, subject to the conditions in this section.
The current list of sub-processors is Part A of the "Recipients and Subprocessors" register; it forms part of this DPA.
The Processor shall inform the Controller of any intended addition or replacement of sub-processors at least 30 days before the change takes effect, giving the Controller the opportunity to object to such changes. The notice is given in text form and states the sub-processor, its service, its location and the safeguard.
If the Controller objects to a new sub-processor on reasonable data protection grounds, the parties shall discuss the objection in good faith. If the objection cannot be resolved, the Controller may terminate the service agreement without penalty as of the date the change was intended to take effect.
The Processor shall impose on each sub-processor, by way of a contract, the same data protection obligations as set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organisational measures.
Where a sub-processor fails to fulfil its data protection obligations, the Processor shall remain fully liable to the Controller for the performance of the sub-processor's obligations.
For sub-processors located outside the EEA, the Processor shall ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR (adequacy decision, Standard Contractual Clauses, or EU-US Data Privacy Framework certification). The list under paragraph 2 states the safeguard relied on for each sub-processor outside the EEA.
Where the Controller uses an AI feature, the Processor transmits the data this requires to the AI sub-processors listed in Part A: for a property valuation, the property record including address and photographs and rent and lease data, but without names or contact details of tenants and other contacts and without loan data; for document reading, the documents the Controller selects, in full and unaltered, including any third-party data and any special categories of personal data they contain; the Processor does not review or redact them beforehand. In a property valuation, search queries, including the address for the rent benchmark, reach the search provider named in Part C through OpenAI (paragraph 9). Using the feature is the instruction to do so. The providers do not use the data for training and store it only for a limited period for abuse detection. Details: AI Transparency Notice.
The bodies listed in Part C of the register are not sub-processors. When the functions named there are used, they receive only the data required for them and process it under their own responsibility. Using the function is the Controller's instruction to make this disclosure, including where it is made to a third country.

§ 10 Data Subject Rights

The Processor shall assist the Controller, by appropriate technical and organisational measures and taking into account the nature of the processing, in fulfilling the Controller's obligation to respond to requests for exercising the data subject's rights under Chapter III of the GDPR (Articles 15 to 22), including:
- Right of access (Article 15)
- Right to rectification (Article 16)
- Right to erasure (Article 17)
- Right to restriction of processing (Article 18)
- Right to data portability (Article 20)
- Right to object (Article 21)
The platform itself enables the Controller to satisfy most such requests directly: records can be viewed, corrected, exported and deleted from within it, and a share or a transfer invitation can be revoked at any time.
If a data subject contacts the Processor directly with a request, the Processor shall promptly forward the request to the Controller and shall not respond to the data subject directly unless instructed by the Controller.

§ 11 Data Breach Notification

The Processor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Controller's data.
The notification shall include, to the extent possible:
- A description of the nature of the breach, including the categories and approximate number of data subjects and personal data records concerned
- The name and contact details of the Processor's contact point for further information
- A description of the likely consequences of the breach
- A description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects
Where the information cannot be provided in full at once, it shall be provided in phases without undue further delay.
The Processor shall assist the Controller in fulfilling its obligations under Articles 33 and 34 of the GDPR (notification to the supervisory authority and communication to data subjects). The obligation to notify the supervisory authority remains that of the Controller.

§ 12 Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR.
The Processor shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller. The Controller shall give at least 14 days' notice of any audit in Text Form.
Audits shall be limited to one audit per calendar year, unless a data breach or other specific incident requires additional audits. Audits shall generally be limited to one business day and shall be conducted during regular business hours. An auditor mandated by the Controller must not be a competitor of the Processor and must be bound to confidentiality.
An audit may not extend to data or systems of other customers of the Processor, and may not compromise the security of the platform.
The Controller shall bear the costs of audits it initiates, unless the audit reveals a material breach of this DPA by the Processor, in which case the Processor shall bear the costs.
The Processor may in the first instance demonstrate compliance through this DPA and the technical and organisational measures, through the current certifications of its infrastructure providers (for example SOC 2 Type II reports or ISO 27001 certificates), and through the results of independent third-party audits, provided these are current and meaningful.

§ 13 Data Deletion and Return

Upon termination of the service agreement, the Processor shall, at the Controller's choice:
- Return all personal data to the Controller in a structured, commonly used, and machine-readable format, or
- Delete all personal data and all existing copies
Several parts of the data can be exported by the Controller directly from within the platform. For a complete export, the Controller may request one in Text Form; the Processor shall provide it within 30 days of the request.
Deleted records, including the Controller's account and organisation, are withdrawn from use immediately and permanently erased after 90 days, together with everything that depends on them, including stored files. By way of exception, the following data is retained, and then permanently erased:
- Deleted loans with a change history and deleted properties with such a history or an ownership transfer: until the organisation is deleted, and thereafter like the organisation.
- Data of an ownership transfer in which another organisation takes part, with its event history and its documents, the transferred property without its other content, and only the name of the selling organisation: until that other organisation is permanently erased. Ownership transfers still in progress are ended 90 days after the organisation's deletion.
- Deleted records that a record still stored refers to, for example a contact that a lease refers to: until the referring record is permanently erased.
- Log entries that record a read access or contain an IP address or browser identifier: 12 months after they were written; all other log entries: until 31 December of the third year after the year in which they were written; log entries that record a read access or the handover of ownership and are assigned to a deleted organisation: at most until 90 days after its deletion.
- Cancellation and withdrawal declarations received through the online functions: until 31 December of the third year after the year of receipt.
- Data of an organisation for which the Processor has suspended erasure under paragraph 4 sentence 3, and data of the ownership transfers in which it takes part: to the extent and for as long as the suspension applies.
The retention of the log entries and declarations serves to establish, exercise or defend the Processor's own legal claims within the regular limitation period (§§ 195, 199 BGB); to that extent the Processor is itself a controller. During this period the data is not processed for any other purpose.
Data subject to statutory retention obligations (for example financial records under § 147 AO, commercial correspondence under § 257 HGB) shall be retained for the legally required period and then deleted. During this period the data shall be restricted from processing and used only for the purpose of complying with the retention obligation. Where Union or Member State law requires storage of the data, the Processor may suspend deletion for the organisation concerned.
The Processor shall confirm the completion of data deletion upon the Controller's request.
Backups are overwritten in the ordinary backup cycle. A record deleted under paragraph 3 may persist in a backup until that cycle completes; it is not restored into the live system and is not otherwise processed.

§ 14 Assistance with Compliance Obligations

The Processor shall assist the Controller in ensuring compliance with the following obligations, taking into account the nature of the processing and the information available to the Processor:

Security of processing (Article 32 GDPR)
Notification of personal data breaches to supervisory authorities (Article 33 GDPR)
Communication of personal data breaches to data subjects (Article 34 GDPR)
Data protection impact assessments (Article 35 GDPR)
Prior consultation with supervisory authorities (Article 36 GDPR)

Where such assistance goes materially beyond providing information that already exists, the Processor may charge its reasonable costs, having first informed the Controller.

§ 15 Liability

The liability of the parties under this DPA is governed by Article 82 of the GDPR and the liability provisions of the Terms of Service. Each party is liable for damages caused by processing that infringes the GDPR, in accordance with its respective role as Controller or Processor. Nothing in this DPA limits the rights of data subjects under Article 82 GDPR.

§ 16 Final Provisions

This DPA is governed by the laws of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods (CISG).
In the event of any conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to data protection matters.
Changes to this DPA require the Controller's consent in Text Form (§ 126b BGB). Towards business customers (Unternehmer), a change is deemed approved if the Controller does not object within six weeks of receiving a notice in Text Form that expressly states the changes and this consequence; this applies only to changes that are legally required or do not reduce the level of protection. The list of sub-processors and the technical and organisational measures change only under § 9 and § 7(3).
If any provision of this DPA is or becomes invalid, the remaining provisions shall remain in force. The invalid provision shall be replaced by a valid provision that most closely reflects the original intent.

The effective date of this version is displayed above this document.